Integrations

WhatsApp API for Make (HTTP module, custom webhook)

Connect Make to HelloHop with its HTTP tools and your linked number's channel token. Send text with a JSON POST request, or add a participant to an existing group. For incoming events, verify the webhook signature in a receiver you control before forwarding accepted events to your automation's webhook trigger.

Send a text with Make

Add HTTP > Make a request. Set Method to POST and enter the URL and headers below. Choose an application/json request body and enter the JSON below as the body.

{
  "to": "66XXXXXXXXX",
  "text": "Thanks, see you tomorrow"
}

Replace CHANNEL_ID and CHANNEL_TOKEN with your channel credentials. Replace the recipient placeholder with someone expecting your message. Store credentials privately in your automation platform. A server_ack response means server acceptance, not delivery. Keep the returned id for message.status events.

Add a participant to an existing group

Use another HTTP > Make a request module with the same headers. Set Method to POST and URL to https://api.hellohop.app/v1/sessions/CHANNEL_ID/groups/[email protected]/participants. Replace the example group JID with your group's JID and use this body:

{
  "action": "add",
  "participants": [
    "66XXXXXXXXX"
  ]
}

Ask for permission before adding someone. The linked number needs the required group permissions, and participant privacy settings can prevent an add. Inspect each results entry and its status. An unknown result may already have applied; read the group before trying again.

Receive verified events in Make

Create the Webhooks > Custom webhook module and save its URL privately in your queue worker. The public receiver must check X-Wagate-Signature, the lowercase hex HMAC-SHA256 of the exact raw body with your receiver secret, before parsing JSON or accepting an event. Re-serializing parsed JSON does not preserve the signed bytes.

Save the verifier as verify.js and the receiver as receiver.js in a Node.js project configured for ES modules, with Express installed. Supply WEBHOOK_SECRET privately. The queue.js import is your own implementation: persist accepted events before acknowledging them, then forward them from a worker to the automation hook. This receiver is a starting point, not a complete queue service.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifySignature(rawBody, signatureHeader, secret) {
  // A JSON body parser that ran first leaves a parsed object, not bytes: refuse it rather than throw.
  if (!Buffer.isBuffer(rawBody) || !secret || !signatureHeader) return false; // an empty key would accept a forgery signed with an empty key
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  const given = Buffer.from(signatureHeader);
  const want = Buffer.from(expected);
  return given.length === want.length && timingSafeEqual(given, want);
}

import express from 'express';
import { verifySignature } from './verify.js';
import { enqueueDurably } from './queue.js'; // your durable queue or database write

const app = express();
const { WEBHOOK_SECRET: SECRET } = process.env;
if (!SECRET) throw new Error('Set WEBHOOK_SECRET before you start');
const seen = new Set(); // illustration only: production needs a durable dedupe store

app.post('/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verifySignature(req.body, req.get('x-wagate-signature'), SECRET)) {
    return res.sendStatus(401);
  }
  const event = JSON.parse(req.body.toString('utf8'));
  // The delivery header is NOT signed. Dedupe on the id inside the signed body.
  if (seen.has(event.id)) return res.sendStatus(200); // a retry of an event you already accepted
  try {
    await enqueueDurably(event); // persist first; process from the queue later
  } catch {
    return res.sendStatus(500); // not accepted: non-2xx so the sender retries
  }
  seen.add(event.id); // mark seen only after the event is safely stored
  res.sendStatus(200);
});

app.listen(3000);

Use a durable, atomic dedupe store keyed by the verified body event.id in production; the sample's in-memory Set is illustrative. X-Wagate-Delivery is not signed and is not a trusted dedupe key. Reject invalid signatures with 401. A failed durable write must return non-2xx so delivery can be retried.

Register your verifying receiver

Set CHANNEL_ID and CHANNEL_TOKEN in your shell. Replace https://example.com/webhook with your verifying receiver URL and replace the secret with a private value of at least 24 characters, matching WEBHOOK_SECRET. PUT replaces the whole receiver list: retain any existing receivers you still need. The following POST sends a signed test event to that configured URL.

API=https://api.hellohop.app/v1
BASE="$API/sessions/$CHANNEL_ID"
AUTH="Authorization: Bearer $CHANNEL_TOKEN"

curl -s -X PUT "$BASE/webhooks" \
  -H "$AUTH" \
  -H "Content-Type: application/json" \
  -d '{"receivers":[{"url":"https://example.com/webhook","events":["message","message.status"],"secret":"REPLACE_WITH_24_PLUS_CHARACTERS"}]}'

curl -s -X POST "$BASE/webhooks/test" \
  -H "$AUTH" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/webhook"}'

Control retries and sending pace in your workflow

Disable automatic retries for sends and group changes with uncertain outcomes. There is no API idempotency key. A timeout, lost response or send_unconfirmed can mean the operation reached WhatsApp. Record the uncertainty and reconcile before resending. Dedupe incoming events before letting them trigger a send.

You control recipient consent, pacing, jitter and warm-up in your own workflow. HelloHop does not pace or jitter customer sends. Sandbox allowances and in-flight work caps still apply.

HelloHop is an independent WhatsApp API for developers: send and receive messages, automate groups and communities, and get signed webhooks with a free sandbox. Not affiliated with WhatsApp or Meta. You link your own number.